Work out netflow storage requirement instantly with clear inputs, formula shown and shareable results.
Flow storage is records per second times record size times retention, and sampling divides the record count directly. At 1-in-1000 sampling, 50,000 flows per second becomes 50 records per second — three orders of magnitude cheaper to store, at the cost of statistical rather than exact accounting, which is fine for capacity planning but not for forensic per-flow investigation.
Flow storage
sampled flows = flows / sampling rate; daily bytes = sampled x record size x 86400; total = daily x retention days
For volumetric detection no, but low-and-slow reconnaissance can be missed entirely. Security use cases usually need unsampled flow on critical links.
Multiply byte and packet counts by the sampling rate. That estimate is accurate for large flows and unreliable for small ones, which is the fundamental limitation.